admin 7fcda8f1a4 R-699: a unit that holds no data is never an update-precondition copy (found live on 9202) ...

A just-installed app's unit, captured by the status refresh before any backup, satisfied
the precondition on its manifest time; tandoor's PostgreSQL was converted with no backup
of its database. Listed still; never a copy on Tier 1 or Tier 2. Red-proof RP6.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-09-27 12:04:03 +02:00

..

a_version_travel_test.go

R-699: a unit that holds no data is never an update-precondition copy (found live on 9202)

2026-09-27 12:04:03 +02:00

admission_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

admission.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

appbackup_bridge.go

R-102 phase 1.1: split the recovery-unit path helpers, zero behaviour change

2026-08-31 11:16:02 +02:00

appstop_drivegate_test.go

v0.191.0 — warn before the wall comes down (R-167, R-158, R-174)

2026-08-02 23:18:51 +02:00

appstop_marker_test.go

v0.189.0 — desired state + the app-stop crash marker (R-166 / D-b)

2026-08-02 18:40:17 +02:00

appstop_marker.go

R-330: stop the backup alarming about the apps it is holding down (v0.224.0)

2026-08-30 17:58:15 +02:00

appstop_suppress_test.go

R-330: stop the backup alarming about the apps it is holding down (v0.224.0)

2026-08-30 17:58:15 +02:00

appstop_suppress.go

R-330: stop the backup alarming about the apps it is holding down (v0.224.0)

2026-08-30 17:58:15 +02:00

backup.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

capture_floor_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

d28_unhealthy_hold_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

data_versions.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

device_seam_test.go

v0.150.0 — green gate restored + the export link stops leaking the CSRF token

2026-07-20 09:42:24 +02:00

f5_stale_primary_test.go

controller: F7 atomic volume dumps + F6 no-single-copy + F5 stale-primary sweep (WIP, pre-build)

2026-07-12 09:00:16 +02:00

f6_single_copy_test.go

controller: F7 atomic volume dumps + F6 no-single-copy + F5 stale-primary sweep (WIP, pre-build)

2026-07-12 09:00:16 +02:00

file_legs.go

v0.244.0: the backup page stops promising what it does not hold (R-537/R-538/R-536)

2026-09-16 16:55:55 +02:00

kept_load_test.go

kept data: the choice at reinstall, the list, the read-only view, the load (09 decision 36); R-690 fixed

2026-09-25 13:32:30 +02:00

kept_load.go

kept data: the choice at reinstall, the list, the read-only view, the load (09 decision 36); R-690 fixed

2026-09-25 13:32:30 +02:00

migration_exclusion_test.go

B1: data-migration engine (MigrateAll + MigrateApp) + backup mutual-exclusion

2026-06-14 19:42:57 +02:00

offbox_3a_test.go

v0.205.0 — a run that skipped an app the customer selected is not successful (R-234)

2026-08-06 21:58:21 +02:00

offbox_abandon_pin_r302_test.go

R-302: the abandon banner promises only what the box can still see is true

2026-08-12 15:27:29 +02:00

offbox_abandon_r241_test.go

R-241 part 5: escalating reminders, and operator levers for a running countdown

2026-08-07 12:08:11 +02:00

offbox_abandon.go

R-302: the abandon banner promises only what the box can still see is true

2026-08-12 15:27:29 +02:00

offbox_capture.go

v0.205.0 — a run that skipped an app the customer selected is not successful (R-234)

2026-08-06 21:58:21 +02:00

offbox_declare_test.go

v0.201.0 — a correct recovery code is never called wrong again (CAMPAIGN-11) — MinAgent 0.125.0

2026-08-05 17:48:08 +02:00

offbox_integrity.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

offbox_inventory_test.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

offbox_inventory.go

controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

2026-09-13 19:26:50 +02:00

offbox_lastsuccess_test.go

R-100: record the offsite last-SUCCESS anchor (v0.181.0)

2026-07-28 13:12:37 +02:00

offbox_mintguard_r241_test.go

R-241 part 1: the box does not mint a repository key over a sealed package

2026-08-07 11:25:58 +02:00

offbox_offer_shapec_r241_test.go

R-241 part 2: the comparison the box already makes becomes the thing that offers recovery

2026-08-07 11:33:42 +02:00

offbox_orphan_test.go

v0.142.0: offsite repo continuity — orphaned-repo guard (A) + run-status auto-refresh (C)

2026-07-17 10:47:30 +02:00

offbox_place_test.go

R-356: the off-site restore refused every app that has no data drive

2026-08-22 13:08:46 +02:00

offbox_placement_refusal_test.go

R-356: the off-site restore refused every app that has no data drive

2026-08-22 13:08:46 +02:00

offbox_placement_test.go

R-351: the restore compares where the backup says the data lived; second press cannot start a second run

2026-08-21 21:04:16 +02:00

offbox_placement.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

offbox_progress_test.go

v0.147.3 — 4c follow-up 3: the run does not end with the last app

2026-07-19 09:54:18 +02:00

offbox_progress.go

v0.148.0 — coherent snapshot pairs + an offsite restore that actually restores (R-43 + R-44)

2026-07-19 12:21:16 +02:00

offbox_proof.go

R-414: the fallback scratch must also be DELETABLE - caught by live validation

2026-09-01 10:29:08 +02:00

offbox_reconstitute_test.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

offbox_reconstitute.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

offbox_recorded_unit_test.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

offbox_recovery_check_test.go

controller v0.196.0: the recovered key installs itself (R-200 plumbing half) -- MinAgent 0.125.0

2026-08-04 14:27:38 +02:00

offbox_recovery_check.go

controller v0.195.0: prove the offsite key comes back (R-200 plumbing half) -- MinAgent 0.125.0

2026-08-04 13:42:50 +02:00

offbox_recovery_cli.go

v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

2026-09-18 11:44:30 +02:00

offbox_restore.go

v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

2026-09-18 11:44:30 +02:00

offbox_scratch_test.go

Tier-2 engine rework: class-driven legs, v2 layout, NAS-target exclusion (Task 3b, v0.135.0)

2026-07-15 10:10:20 +02:00

offbox_shares_test.go

feat(shares): R-7b Part 3 — offsite shares leg (Model B') + B' isolation proof

2026-07-18 12:51:46 +02:00

offbox_shares.go

feat(shares): R-7b Part 3 — offsite shares leg (Model B') + B' isolation proof

2026-07-18 12:51:46 +02:00

offbox_statsknown_report_test.go

R-331 (controller half): forward stats_known so the hub can tell empty from unmeasured (v0.225.0)

2026-08-30 18:38:10 +02:00

offbox_test.go

controller: zero-toggle honesty — a configured+escrowed offbox with no app selected shows 'Nincs távoli mentésre jelölt alkalmazás…' on the toggle list, and a zero-toggle run reports 'Sikeres — nincs mentésre jelölt alkalmazás' instead of bare success

2026-07-13 08:27:52 +02:00

offbox_verdict_r203_test.go

R-203 Part 2: a run that missed a MANDATORY directory is not a successful run (v0.197.0)

2026-08-04 18:32:56 +02:00

offbox_verdict_r234_test.go

v0.205.0 — a run that skipped an app the customer selected is not successful (R-234)

2026-08-06 21:58:21 +02:00

offbox_verify_copies_test.go

v0.147.0 — feedback slice 1: pressing a button says something

2026-07-19 09:30:30 +02:00

offbox_verify_copies.go

v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

2026-09-18 11:44:30 +02:00

offbox.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

offsite_diag_test.go

v0.254.0 — the saved notes follow the language, and the switch becomes a globe (R-557 slice 2 release C; SLICE 2 CLOSED)

2026-09-18 14:19:31 +02:00

opstatus_recent_test.go

R-351: the restore compares where the backup says the data lived; second press cannot start a second run

2026-08-21 21:04:16 +02:00

opstatus_test.go

feat(backup): async restore family — no proxy-timeout error page on a succeeding restore (v0.102.0)

2026-07-06 20:23:49 +02:00

opstatus.go

v0.246.0: an interrupted restore is told; the recovery-code reminder waits until the box can take it

2026-09-17 10:45:29 +02:00

r47_replay_order_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

r87_judgement_test.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r87_proof_job_test.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r87_wiring_test.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r102_tier2_unit_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

r102_unit_at_test.go

R-102: the recovery unit on the second drive becomes a way back

2026-08-31 11:30:34 +02:00

r103_file_restore_untouched_test.go

R-103: the Tier-2 refusal becomes an action

2026-08-31 11:42:03 +02:00

r354_volume_replay_test.go

v0.218.0: attribute a DB container by its compose project, and replay volumes on the off-site restore

2026-08-22 09:43:22 +02:00

r355_safetydump_test.go

R-361: the safety dump destroyed the app's own database backup

2026-08-22 23:39:59 +02:00

r356_hot_only_restore_test.go

R-356: the off-site restore refused every app that has no data drive

2026-08-22 13:08:46 +02:00

r357_reconstitute_headroom_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

r358_scratch_marker_test.go

R-359 + R-397: the off-site store gets checked, and the advertised check becomes real

2026-08-30 21:03:29 +02:00

r359_dueness_test.go

R-359 + R-397: the off-site store gets checked, and the advertised check becomes real

2026-08-30 21:03:29 +02:00

r359_integrity_test.go

v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

2026-08-31 10:24:29 +02:00

r359_lock_safety_test.go

R-359 + R-397: the off-site store gets checked, and the advertised check becomes real

2026-08-30 21:03:29 +02:00

r361_canonical_dump_test.go

R-361 follow-on: the undo-copy prune must run above the already-current check

2026-08-23 00:02:32 +02:00

r379_rollback_test.go

R-361: the safety dump destroyed the app's own database backup

2026-08-22 23:39:59 +02:00

r383_undo_phrase_test.go

v0.254.0 — the saved notes follow the language, and the switch becomes a globe (R-557 slice 2 release C; SLICE 2 CLOSED)

2026-09-18 14:19:31 +02:00

r399_depth_test.go

v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

2026-08-31 10:24:29 +02:00

r399_slow_notice_test.go

v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

2026-08-31 10:24:29 +02:00

r403_hollow_test.go

v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

2026-09-18 11:44:30 +02:00

r403_hollow.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r403_mirror_guard_test.go

v0.254.0 — the saved notes follow the language, and the switch becomes a globe (R-557 slice 2 release C; SLICE 2 CLOSED)

2026-09-18 14:19:31 +02:00

r403_rehydrate_test.go

R-403: a poorer copy must never delete a richer one

2026-08-31 14:02:13 +02:00

r408_invariant_walk_test.go

controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

2026-09-13 19:26:50 +02:00

r411_lock_flag_test.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

r412a_push_wording_test.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

r414_reachability_test.go

R-414: the fallback scratch must also be DELETABLE - caught by live validation

2026-09-01 10:29:08 +02:00

r474_remove_mirrors.go

controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

2026-09-13 19:26:50 +02:00

r476_unit_data_date_test.go

controller v0.242.0: a removed app is listed with its kept backup; five small ones (R-487 R-491 R-490 R-489 R-476 R-456)

2026-09-13 22:50:18 +02:00

r477_r474_test.go

controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

2026-09-13 19:26:50 +02:00

r479_tier_order_test.go

v0.263.0: a failed update puts the app back by itself (09 decision 15, R-637)

2026-09-23 11:12:49 +02:00

r487_removed_units_test.go

controller v0.242.0: a removed app is listed with its kept backup; five small ones (R-487 R-491 R-490 R-489 R-476 R-456)

2026-09-13 22:50:18 +02:00

r538_unit_restore_refusal_test.go

v0.244.0: the backup page stops promising what it does not hold (R-537/R-538/R-536)

2026-09-16 16:55:55 +02:00

r553_offsite_quota_test.go

v0.254.0 — the saved notes follow the language, and the switch becomes a globe (R-557 slice 2 release C; SLICE 2 CLOSED)

2026-09-18 14:19:31 +02:00

r634_deploying_test.go

controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

2026-09-23 17:16:57 +02:00

r640_incomplete_dump_test.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

r658_restore_labels_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

r659_whole_copy_test.go

R-699: a unit that holds no data is never an update-precondition copy (found live on 9202)

2026-09-27 12:04:03 +02:00

r660_update_held_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

r668_missing_path_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

r669_applied_meta_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r671_undo_copies_test.go

controller v0.272.0: the backup page says when a whole-box backup does not fit (R-685); R-671, R-670, R-677

2026-09-25 11:19:27 +02:00

r690_removed_unit_test.go

kept data: the choice at reinstall, the list, the read-only view, the load (09 decision 36); R-690 fixed

2026-09-25 13:32:30 +02:00

recovery_unit_notify_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

recovery_unit_test.go

D5: an app restore works from the drive alone (v0.188.0)

2026-07-30 16:33:06 +02:00

recovery_unit.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

removed_units.go

R-699: a unit that holds no data is never an update-precondition copy (found live on 9202)

2026-09-27 12:04:03 +02:00

restore_db_test.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

restore_db.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

restore_destination_test.go

v0.207.0 — R-249: the retrieval passphrase leaves the page body; R-252/R-253: two refusals learn to say what to do

2026-08-07 18:04:26 +02:00

restore_points_test.go

test: F6 restore-point SSD label now clear (was blank)

2026-07-12 09:01:17 +02:00

restore_points.go

R-699: a unit that holds no data is never an update-precondition copy (found live on 9202)

2026-09-27 12:04:03 +02:00

restore_record_test.go

v0.246.0: an interrupted restore is told; the recovery-code reminder waits until the box can take it

2026-09-17 10:45:29 +02:00

restore_record.go

v0.254.0 — the saved notes follow the language, and the switch becomes a globe (R-557 slice 2 release C; SLICE 2 CLOSED)

2026-09-18 14:19:31 +02:00

restore_secrets_gen_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

restore_unit_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

restore_unit.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

restore.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

runsummary_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

runsummary.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

shares_payload.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

shares_restore_test.go

feat(shares): R-7b Parts 4-6 — shares restore, samba liveness, UI truth-up

2026-07-18 13:02:41 +02:00

shares_restore.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

shares_test.go

v0.150.0 — green gate restored + the export link stops leaking the CSRF token

2026-07-20 09:42:24 +02:00

slice4_update_guard_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

tier2_anchor_test.go

R-101 + F-DIAG: the restore dialog names the last SUCCESSFUL copy (v0.182.0)

2026-07-28 16:36:47 +02:00

tier2_capture.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

tier2_coverage_test.go

C9-F1 + C9-F2: a restore that restored nothing, and a crash loop nobody saw (v0.183.0)

2026-07-28 18:53:56 +02:00

tier2_restore_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

tier2_restore.go

R-699: a unit that holds no data is never an update-precondition copy (found live on 9202)

2026-09-27 12:04:03 +02:00

tier2_shares.go

v0.254.0 — the saved notes follow the language, and the switch becomes a globe (R-557 slice 2 release C; SLICE 2 CLOSED)

2026-09-18 14:19:31 +02:00

tier2_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

tier2_v2_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

tier2_whole_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

tier2_whole.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

tier2.go

v0.254.0 — the saved notes follow the language, and the switch becomes a globe (R-557 slice 2 release C; SLICE 2 CLOSED)

2026-09-18 14:19:31 +02:00

undo_hold_test.go

controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

2026-09-23 17:16:57 +02:00

update_guard.go

R-699: a unit that holds no data is never an update-precondition copy (found live on 9202)

2026-09-27 12:04:03 +02:00

update_tiers_test.go

R-699: a unit that holds no data is never an update-precondition copy (found live on 9202)

2026-09-27 12:04:03 +02:00

volume_atomic_test.go

controller: F7 atomic volume dumps + F6 no-single-copy + F5 stale-primary sweep (WIP, pre-build)

2026-07-12 09:00:16 +02:00

volume_dumps_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00