admin b93c1543da controller v0.239.0: any backup tier lets an app update (R-475) ...

Operator ruling 2026-09-13. The update precondition walks Tier 2, Tier 1
(own recovery unit, "helyi") and Tier 3 (off-site, 15 s bound; unreachable
counts as absent with a WARN) and leans on the first FRESH copy; the
backup_max_age rule applies to whichever tier is chosen. No copy anywhere:
back up first. Refused only when nothing exists and no backup can be taken.
RunAppBackupNow tolerates a Tier-2 failure (WARN) and marks the captured
unit proven current. The hold names the tier (második meghajtó / saját
meghajtó / távoli mentés) and the date; pre-v0.239.0 holds keep their text.
A successful off-site restore now lifts an update hold. The backups page
still uses Tier2UnitRestorePoint unchanged.

Scenarios G-M tested; red-proofs M, L, the tail and the off-site clear in
felhom.eu documentation/audits/rulings-r472-r475-2026-09-13/.

2026-09-13 17:16:24 +02:00

..

admission_test.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

admission.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

appbackup_bridge.go

R-102 phase 1.1: split the recovery-unit path helpers, zero behaviour change

2026-08-31 11:16:02 +02:00

appstop_drivegate_test.go

v0.191.0 — warn before the wall comes down (R-167, R-158, R-174)

2026-08-02 23:18:51 +02:00

appstop_marker_test.go

v0.189.0 — desired state + the app-stop crash marker (R-166 / D-b)

2026-08-02 18:40:17 +02:00

appstop_marker.go

R-330: stop the backup alarming about the apps it is holding down (v0.224.0)

2026-08-30 17:58:15 +02:00

appstop_suppress_test.go

R-330: stop the backup alarming about the apps it is holding down (v0.224.0)

2026-08-30 17:58:15 +02:00

appstop_suppress.go

R-330: stop the backup alarming about the apps it is holding down (v0.224.0)

2026-08-30 17:58:15 +02:00

backup.go

controller v0.239.0: any backup tier lets an app update (R-475)

2026-09-13 17:16:24 +02:00

capture_floor_test.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

device_seam_test.go

v0.150.0 — green gate restored + the export link stops leaking the CSRF token

2026-07-20 09:42:24 +02:00

f5_stale_primary_test.go

controller: F7 atomic volume dumps + F6 no-single-copy + F5 stale-primary sweep (WIP, pre-build)

2026-07-12 09:00:16 +02:00

f6_single_copy_test.go

controller: F7 atomic volume dumps + F6 no-single-copy + F5 stale-primary sweep (WIP, pre-build)

2026-07-12 09:00:16 +02:00

migration_exclusion_test.go

B1: data-migration engine (MigrateAll + MigrateApp) + backup mutual-exclusion

2026-06-14 19:42:57 +02:00

offbox_3a_test.go

v0.205.0 — a run that skipped an app the customer selected is not successful (R-234)

2026-08-06 21:58:21 +02:00

offbox_abandon_pin_r302_test.go

R-302: the abandon banner promises only what the box can still see is true

2026-08-12 15:27:29 +02:00

offbox_abandon_r241_test.go

R-241 part 5: escalating reminders, and operator levers for a running countdown

2026-08-07 12:08:11 +02:00

offbox_abandon.go

R-302: the abandon banner promises only what the box can still see is true

2026-08-12 15:27:29 +02:00

offbox_capture.go

v0.205.0 — a run that skipped an app the customer selected is not successful (R-234)

2026-08-06 21:58:21 +02:00

offbox_declare_test.go

v0.201.0 — a correct recovery code is never called wrong again (CAMPAIGN-11) — MinAgent 0.125.0

2026-08-05 17:48:08 +02:00

offbox_integrity.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

offbox_inventory_test.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

offbox_inventory.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

offbox_lastsuccess_test.go

R-100: record the offsite last-SUCCESS anchor (v0.181.0)

2026-07-28 13:12:37 +02:00

offbox_mintguard_r241_test.go

R-241 part 1: the box does not mint a repository key over a sealed package

2026-08-07 11:25:58 +02:00

offbox_offer_shapec_r241_test.go

R-241 part 2: the comparison the box already makes becomes the thing that offers recovery

2026-08-07 11:33:42 +02:00

offbox_orphan_test.go

v0.142.0: offsite repo continuity — orphaned-repo guard (A) + run-status auto-refresh (C)

2026-07-17 10:47:30 +02:00

offbox_place_test.go

R-356: the off-site restore refused every app that has no data drive

2026-08-22 13:08:46 +02:00

offbox_placement_refusal_test.go

R-356: the off-site restore refused every app that has no data drive

2026-08-22 13:08:46 +02:00

offbox_placement_test.go

R-351: the restore compares where the backup says the data lived; second press cannot start a second run

2026-08-21 21:04:16 +02:00

offbox_placement.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

offbox_progress_test.go

v0.147.3 — 4c follow-up 3: the run does not end with the last app

2026-07-19 09:54:18 +02:00

offbox_progress.go

v0.148.0 — coherent snapshot pairs + an offsite restore that actually restores (R-43 + R-44)

2026-07-19 12:21:16 +02:00

offbox_proof.go

R-414: the fallback scratch must also be DELETABLE - caught by live validation

2026-09-01 10:29:08 +02:00

offbox_reconstitute_test.go

R-361: the safety dump destroyed the app's own database backup

2026-08-22 23:39:59 +02:00

offbox_reconstitute.go

controller v0.239.0: any backup tier lets an app update (R-475)

2026-09-13 17:16:24 +02:00

offbox_recorded_unit_test.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

offbox_recovery_check_test.go

controller v0.196.0: the recovered key installs itself (R-200 plumbing half) -- MinAgent 0.125.0

2026-08-04 14:27:38 +02:00

offbox_recovery_check.go

controller v0.195.0: prove the offsite key comes back (R-200 plumbing half) -- MinAgent 0.125.0

2026-08-04 13:42:50 +02:00

offbox_recovery_cli.go

R-193: the recovery screen — unlocking, and only unlocking (v0.200.0)

2026-08-05 12:45:48 +02:00

offbox_restore.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

offbox_scratch_test.go

Tier-2 engine rework: class-driven legs, v2 layout, NAS-target exclusion (Task 3b, v0.135.0)

2026-07-15 10:10:20 +02:00

offbox_shares_test.go

feat(shares): R-7b Part 3 — offsite shares leg (Model B') + B' isolation proof

2026-07-18 12:51:46 +02:00

offbox_shares.go

feat(shares): R-7b Part 3 — offsite shares leg (Model B') + B' isolation proof

2026-07-18 12:51:46 +02:00

offbox_statsknown_report_test.go

R-331 (controller half): forward stats_known so the hub can tell empty from unmeasured (v0.225.0)

2026-08-30 18:38:10 +02:00

offbox_test.go

controller: zero-toggle honesty — a configured+escrowed offbox with no app selected shows 'Nincs távoli mentésre jelölt alkalmazás…' on the toggle list, and a zero-toggle run reports 'Sikeres — nincs mentésre jelölt alkalmazás' instead of bare success

2026-07-13 08:27:52 +02:00

offbox_verdict_r203_test.go

R-203 Part 2: a run that missed a MANDATORY directory is not a successful run (v0.197.0)

2026-08-04 18:32:56 +02:00

offbox_verdict_r234_test.go

v0.205.0 — a run that skipped an app the customer selected is not successful (R-234)

2026-08-06 21:58:21 +02:00

offbox_verify_copies_test.go

v0.147.0 — feedback slice 1: pressing a button says something

2026-07-19 09:30:30 +02:00

offbox_verify_copies.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

offbox.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

offsite_diag_test.go

R-101 + F-DIAG: the restore dialog names the last SUCCESSFUL copy (v0.182.0)

2026-07-28 16:36:47 +02:00

opstatus_recent_test.go

R-351: the restore compares where the backup says the data lived; second press cannot start a second run

2026-08-21 21:04:16 +02:00

opstatus_test.go

feat(backup): async restore family — no proxy-timeout error page on a succeeding restore (v0.102.0)

2026-07-06 20:23:49 +02:00

opstatus.go

R-351: the restore compares where the backup says the data lived; second press cannot start a second run

2026-08-21 21:04:16 +02:00

r47_replay_order_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

r87_judgement_test.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r87_proof_job_test.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r87_wiring_test.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r102_tier2_unit_test.go

R-102: the recovery unit on the second drive becomes a way back

2026-08-31 11:30:34 +02:00

r102_unit_at_test.go

R-102: the recovery unit on the second drive becomes a way back

2026-08-31 11:30:34 +02:00

r103_file_restore_untouched_test.go

R-103: the Tier-2 refusal becomes an action

2026-08-31 11:42:03 +02:00

r354_volume_replay_test.go

v0.218.0: attribute a DB container by its compose project, and replay volumes on the off-site restore

2026-08-22 09:43:22 +02:00

r355_safetydump_test.go

R-361: the safety dump destroyed the app's own database backup

2026-08-22 23:39:59 +02:00

r356_hot_only_restore_test.go

R-356: the off-site restore refused every app that has no data drive

2026-08-22 13:08:46 +02:00

r357_reconstitute_headroom_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

r358_scratch_marker_test.go

R-359 + R-397: the off-site store gets checked, and the advertised check becomes real

2026-08-30 21:03:29 +02:00

r359_dueness_test.go

R-359 + R-397: the off-site store gets checked, and the advertised check becomes real

2026-08-30 21:03:29 +02:00

r359_integrity_test.go

v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

2026-08-31 10:24:29 +02:00

r359_lock_safety_test.go

R-359 + R-397: the off-site store gets checked, and the advertised check becomes real

2026-08-30 21:03:29 +02:00

r361_canonical_dump_test.go

R-361 follow-on: the undo-copy prune must run above the already-current check

2026-08-23 00:02:32 +02:00

r379_rollback_test.go

R-361: the safety dump destroyed the app's own database backup

2026-08-22 23:39:59 +02:00

r383_undo_phrase_test.go

v0.222.0: ask whether a supervised member is DEAD before whether one is UNHEALTHY (R-384), and stop promising an undo copy nobody looked for (R-383)

2026-08-23 07:25:00 +02:00

r399_depth_test.go

v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

2026-08-31 10:24:29 +02:00

r399_slow_notice_test.go

v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

2026-08-31 10:24:29 +02:00

r403_hollow_test.go

R-403 fix, caught by the live run: the stale flag fired for every healthy app

2026-08-31 14:22:32 +02:00

r403_hollow.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r403_mirror_guard_test.go

R-403: a poorer copy must never delete a richer one

2026-08-31 14:02:13 +02:00

r403_rehydrate_test.go

R-403: a poorer copy must never delete a richer one

2026-08-31 14:02:13 +02:00

r408_invariant_walk_test.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

r411_lock_flag_test.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

r412a_push_wording_test.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

r414_reachability_test.go

R-414: the fallback scratch must also be DELETABLE - caught by live validation

2026-09-01 10:29:08 +02:00

recovery_unit_notify_test.go

v0.191.0 — warn before the wall comes down (R-167, R-158, R-174)

2026-08-02 23:18:51 +02:00

recovery_unit_test.go

D5: an app restore works from the drive alone (v0.188.0)

2026-07-30 16:33:06 +02:00

recovery_unit.go

v0.237.0: the Update button takes a backup first, and tells the truth (update arc slice 4 — R-448, R-443, R-439)

2026-09-13 11:41:31 +02:00

restore_db_test.go

F17: per-app restore now replays the captured .sql DB dump (.sql wins)

2026-06-14 10:02:58 +02:00

restore_db.go

R-102: the recovery unit on the second drive becomes a way back

2026-08-31 11:30:34 +02:00

restore_destination_test.go

v0.207.0 — R-249: the retrieval passphrase leaves the page body; R-252/R-253: two refusals learn to say what to do

2026-08-07 18:04:26 +02:00

restore_points_test.go

test: F6 restore-point SSD label now clear (was blank)

2026-07-12 09:01:17 +02:00

restore_points.go

controller: F7 atomic volume dumps + F6 no-single-copy + F5 stale-primary sweep (WIP, pre-build)

2026-07-12 09:00:16 +02:00

restore_secrets_gen_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

restore_unit_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

restore_unit.go

v0.237.0: the Update button takes a backup first, and tells the truth (update arc slice 4 — R-448, R-443, R-439)

2026-09-13 11:41:31 +02:00

restore.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

runsummary_test.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

runsummary.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

shares_payload.go

feat(shares): R-7b Parts 1-2 — shares payload builder + tier-2 shares job (Model B')

2026-07-18 12:45:57 +02:00

shares_restore_test.go

feat(shares): R-7b Parts 4-6 — shares restore, samba liveness, UI truth-up

2026-07-18 13:02:41 +02:00

shares_restore.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

shares_test.go

v0.150.0 — green gate restored + the export link stops leaking the CSRF token

2026-07-20 09:42:24 +02:00

slice4_update_guard_test.go

controller v0.239.0: any backup tier lets an app update (R-475)

2026-09-13 17:16:24 +02:00

tier2_anchor_test.go

R-101 + F-DIAG: the restore dialog names the last SUCCESSFUL copy (v0.182.0)

2026-07-28 16:36:47 +02:00

tier2_capture.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

tier2_coverage_test.go

C9-F1 + C9-F2: a restore that restored nothing, and a crash loop nobody saw (v0.183.0)

2026-07-28 18:53:56 +02:00

tier2_restore_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

tier2_restore.go

R-403 fix, caught by the live run: the stale flag fired for every healthy app

2026-08-31 14:22:32 +02:00

tier2_shares.go

R-403: a poorer copy must never delete a richer one

2026-08-31 14:02:13 +02:00

tier2_test.go

Tier-2 engine rework: class-driven legs, v2 layout, NAS-target exclusion (Task 3b, v0.135.0)

2026-07-15 10:10:20 +02:00

tier2_v2_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

tier2.go

v0.237.0: the Update button takes a backup first, and tells the truth (update arc slice 4 — R-448, R-443, R-439)

2026-09-13 11:41:31 +02:00

update_guard.go

controller v0.239.0: any backup tier lets an app update (R-475)

2026-09-13 17:16:24 +02:00

update_tiers_test.go

controller v0.239.0: any backup tier lets an app update (R-475)

2026-09-13 17:16:24 +02:00

volume_atomic_test.go

controller: F7 atomic volume dumps + F6 no-single-copy + F5 stale-primary sweep (WIP, pre-build)

2026-07-12 09:00:16 +02:00

volume_dumps_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00