felhom-controller/REPORT.md

REPORT — night 2026-10-22: four fixes on main, not released

What: the night brief's controller parts. Nothing released (the brief forbids a controller release tonight). Design read: 07-backup-architecture.md §6.1.1 (catch-up), §6.2 (capture set), §10.2; 09 §6.5 (drill catalog). Next release 0.340.0, MinAgent 0.158.1 (unchanged).

• R-49 (operator D21 = B), 6a17c95. .felhom.yml backup.volumes: [{name, class: excluded}] leaves a named volume out of every backup (appbackup.ExcludedDockerVolumes → backup.Manager.dumpableVolumes); declared names only, a list that would exclude every named volume is refused whole. Red-proved (TestR49_*, both packages) and the R-591 deep-copy alias test caught a shared slice (fixed in deepCopyStack). 9202: Immich unit 1 160 553 832 → 336 788 031 B; with the cache volume removed Immich's ML answered after 9.2 s.
• R-1187 (c), d5f88a2. A .fab import over an installed app that is not running merged the old volume data with the bundle's. Reproduced on 9202 rc.1 (a marker written after the export survived the import; the running control replaced it); now refused with a Hungarian sentence, the app untouched (rc.2: markers unchanged; the running path still replaces). Red-proved (r1187c_test.go). Evidence felhom.eu audits/night-2026-10-22/P3-candidates/r1187c-9202.txt.
• R-1189 (d), d5f88a2. The off-site proof (05:30) and integrity check (06:00) never ran on a box that is off then. nightchain.CatchUp.After now runs both once after the catch-up's legs; the false comment in main.go corrected. Red-proved (nightchain/r1189d_test.go, cmd/controller/r1189d_wiring_test.go).
• R-1214, 03c0a69 + ae39467. The 03:30 second-drive copy's page cache pushed the apps out of memory. rsyncMirror runs rsync in a 512 MB memory-capped container of the controller's own image, only for clean /mnt/ paths with no symlink (a security review found the symlink case; fixed and tested). 9202 (4 GB, 1.8 GB held, 6 GB): full stall 5.7 / 2.5 s → 0.37 / 0.32 s; peak „full" 16.8 / 6.9 % → 0.9 / 1.0 %. A real POST /api/backup/tier2 on rc.4: 6 capped containers, each exit 0; Immich's copy equals its source (0 differences, 44 = 44 files). docker_run_volume_path_gate.py allow-list entry with its WHY.
• Gates: controller_gates.py --fast green before each push; CI by commit — see felhom.eu REPORT-night-2026-10-22.md.
• Teardown (9202): throwaway uptime-kuma removed through the product (.fab deleted); hog container and 19 GB of test files removed; memory 25898 MB / swap 512 MB again; Immich's .felhom.yml back to its pre-night file; controller back on 0.339.0 (healthy); the drill catalog equals live main again. Host: /tmp/r1214* removed on demo-hp. Hub: 9202 has no hub link — nothing.